Health and Safety Risk Analyses: 
Information for Better Decisions 

Lester B. Lave 


Knowing die nature and magnitude of health and safety 
risks is helpful in setting priorities as well as in making 
decisions about pursuing recreational activities, foods, 
jobs, and other aspects of everyday living. “Risk-risk” 
situations require a choice among risky alternatives. 
“How safe” situations involve a more general choice as to 
how much of other desired activities to sacrifice for 
increased safety. “How safe” situations are inherently 
more diffialit to manage, because they are subject to fuzzy 
thinking and rhetoric. The large uncertainties of current 
estimates m.ust be conveyed explicitly to arrive at sensible 
decisions. 


W HAT WOULD YOU DO, IN THE FOLLOWING SITUATIONS: 

(i) You have a partially blocked coronary artery that can 
be treated by bypass surgery or medication. Although 
there is a chance of dying during surgery, if you survive you can 
expea less pain and a more active life than from medication, (ii) 
Your neighborhood school contains asbestos materials. School 
officials can ignore the problem or pay for the removal of the 
asbestos with funds from educational programs or a special property 
tax. 

These two situations exemplify the types of health and safety 
hazards that all of us face (7). Intelligent decisions are needed on 
which potential hazards to ignore and how much risk reduction to 
seek. These decisions require information about the nature and 
probability of the hazard, how the risk is perceived, and safety goals. 

The available data and tools to provide this information are 
replete with uncertainty, which complicates the decision process and 
occasionally negates the value of an analysis. The hard choices are 
clothed in uncertainty and confecting goals. People feel deeply 
about heal til and safety issues but become uncomfortable when 
thinking about situations that involve danger to their children or to 
themselves. 

The coronaiy heart disease situation has risks and benefits associ¬ 
ated with both choices. With such “risk-risk” situations, a person 
must seica the better alternative (2). For the asbestos situation, the 
probability of cancer can be lowered, but only by giving up other 
desired services or activities. In such “how safe is safe enough” 
situations, society must decide how much should be sacrificed to 
reduce risk. Each successive reduction in risk generally achieves a bit 
less and costs a little more, such as when reducing the levels of trace 
carcinogens in drinking water ( 3 ). 

Despite die inevitable uncertainties, risk analysis has much to 
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contribute to risk management. Risk analysis helps identify signifi¬ 
cant hazards, stimulates basic research, and spotlights the need to 
agree on health goals and priorities. In tile past decade risk 
quantification has challenged much of the conventional wisdom 
about the safety of our technologies and the efficacy of particular 
interventions. 


Risk Analysis in Medical Decision-Making 

Progress in science enhances understanding of the possible 
sources of harm and allows quantification of the probabilities, at 
least crudely. For example, one to two patients out of 100 die during 
bypass surgery (• 4 ). This datum simplifies the “risk-risk” situation for 
many people who would regard this probability as small in compari¬ 
son with other dangers in this situation. But some individuals are at 
extraordinary risk. The tabulated frequency of deaths is the accumu¬ 
lated experience from many surgeons, hospitals, and patients of 
diverse charaaeristics. The chance of death during surgery would be 
much less for a 40-year-old in good physical condition with no other 
medical problems than for an 80-year-old with severe deterioration 
of the heart muscle and an inexperienced surgeon. 

An individual’s perception of the value of outcomes and desire for 
certainty are important determinants in the decision (5). A sports 
enthusiast might regard medical treatment of coronary heart disease 
as useless. Someone afraid of “dying on the table” might elea 
medical treatment instead of surgery. A patient without insurance 
would see the large costs associated with surgery. Even the way the 
outcomes are described, whether in terms of probability of dying or 
probability of survival, is likely to affea the choice of treatment ( 6 ). 
There is no single optimal decision for all people. 

The key issues in medical decision-making are the extent and 
quality of information about the outcomes of alternative interven¬ 
tions, the incentives influencing the ill person and those treating 
him, and the preferences of those involved (7). Occasionally, 
decisions are as simple as treating a broken bone: information is 
good, treatment is beneficial and carries few complications, and 
there is a dominant decision. More generally, getting the right 
information is difficult or impossible. For example, a specialist in 
one mode of treatment finds it difficult to be neutral in offering 
advice because of his confidence in his skill and approach, his 
unfamiliarity with other approaches, and the financial incentive. 
Even the best available data bristle with snares. For example, 
cigarette smoking is the most important public health issue. Yet 
there is no confident answer to individuals who ask about their risk 
from smoking. Even a more-than-two-pack-a-day smoker has only a 
15.6% chance of dying of a smoking-related disease before age 65 
(36.4% before age 85); thus, some individuals, for genetic or other 
reasons, arc more susceptible than others ( 8 ). 

Risk analysis has enlightened decision-making in two ways. First 
it has allowed quantification of the chances of adverse outcomes 
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more precisely as well as of the quality of life and life expectancy 
implications of alternative modes of treatment. Second, it promotes 
the evaluation of treatment modes and individual performers. Many 
treatment modes have been found to be without efficacy, for 
example, routine removal of tonsils or radical mastectomies (7); 
some hospitals or surgeons have relatively poor outcomes, such as 
surgeons doing only a few coronary bypass operations each year (4). 

Risk estimate are even more important in evaluating screening 
and preventive care, since individuals are counselled to seek these 
services (P). For this counsel to be ethical, not only must the action 
not be harmful, it must have a reasonable chance of benefiting the 
person. For exiunple, on average 7.58% of U.S. women contract 
breast cancer. Early detection (through screening by physical exami¬ 
nation plus x-ray) and treatment was found to decrease breast cancer 
mortality 40% (10). However, the screening is not an unalloyed, 
benefit since a single mammogram in a 35-year-old woman involv¬ 
ing a dose of 1 rad would increase the chance of cancer to between 
7.59 and 7.61%. For annual examinations, the chance of cancer 
would rise to between 7.90 and 8.25%. Thus, mammography can 
have an appreciable risk. Screening at an earlier age or more 
examinations would increase the chance of radiogenic cancer, while 
offering diminishing incremental benefit in detecting disease. Al¬ 
though modem equipment has reduced the dose per plate about 50- 
fold, a screening protocol must balance the hazards of screening 
against those of undetected disease, considering the risk factors for 
each group. 

Some modem equipment is designed to use more than twice as 
many x-rays per examination as in the clinical trial that showed 
efficacy. A Pittsburgh physician reports that in more than half the 
baseline examinations, radiologists recommend retesting because of 
some suspicious aspect of the film (11). The quest for greater 
certainty appem to have led some radiologists to increase the chance 
of inducing cancer, with presumably little improvement in detec¬ 
tion. While the increased sensitivity of the equipment has lowered 
the dose per place significantly, there is still a need to be concerned 
about inducing radiogenic cancer. Some radiologists appear to be 
making a decision about how much uncertainty to tolerate without 
calculating the benefits and risks of the extra plates and follow-up 
test. A risk-benefit calculation is needed and plates should be 
eliminated where they do not change treatment or arc done only to 
avoid malpractice suits. A similar question occurs, although in less 
dramatic form, when physicians order additional tests that do not 
have health threats but do increase costs. How much should society 
be willing to pay to reduce risk? 


Quantification of Bisk 

The dangers of being in a building with undamaged asbestos 
materials can be quantified for the “how safe” situation. The 
probability of children getting mesothelioma or lung cancer from 
such asbestos exposure, in school is estimated to be about five per 
million lifetimes, less than 1/5000 the chance of death faced by these 
children from other current events in their lives (12). This analysis 
leads some to neglect asbestos in order to concentrate on reducing 
other risks, such as reducing time spent in the same room as 
cigarette smoker;, wearing seat belts, or improving the quality of 
children’s education and personal consumption. Others regard this 
additional risk from asbestos as nontrivial and want it removed. 
Careless removal of asbestos, however, can pose major risks to the 
workmen as wdl as to the children; many experts believe that 
asbestos in good repair ought to be left in place and removed only 
when there is a major renovation or a building is demolished (13). 

At the current state of knowledge, quantifying risk is somewhat 

292 


arbitrary. The estimated probabilities have large margins of uncer¬ 
tainty and are calculated from populations that may be quite unlike 
the individual having to make a decision. It is not a comfort to know 
that, on average, exposure to arsenic, chromium, or coke oven gases 
is not a major source of cancer in the United States if you live just 
downwind of a major emissions source (14). 

The best probability estimates would come from a “perfect” 
(controlling for confounding factors) epidemiology study on the 
population of interest at the range of doses or exposures of interest. 
There are no such studies, however, and, for most hazards, no 
human data at all. Epidemiology studies always have one or more of 
the following problems: too few subjects for confident conclusions, 
failure to control for important confounding factors, no data (or 
little data) on exposure, exposure levels many times greater than the 
standards being considered, inadequate diagnosis, subjects lost to 
foilow-up, or subjects who are qualitatively different from the 
population to be protected. The Environmental Protection Agency 
(EPA) classifies epidemiology studies as sufficient, limited, or 
inadequate and then disregards the inadequate studies (15). Since 
experimental manipulation is not possible, a hard-nosed critic would 
regard every study as inadequate. Rather, scientists have to ask what 
can be learned from each study and the studies taken together, and 
how much confidence can be placed in the results (16). 

Often, probabilities must be estimated from laboratory studies. 
Extrapolation of data from rodents or cultured cells to people is 
fraught with difficulties (17,18). Since humans do not have zvmbal 
glands, how should one interpret a study finding that a chemical 
causes cancer in the zymbal gland of rats? Until science is able to 
clarify the implications of such findings, regulators usually make the 
most conservative (that is, worst case), plausible assumption in each 
situation—for example, any chemical that increases the number of 
tumors (benign or malignant) in rodents (even in the zymbal gland) 
is assumed to be carcinogenic in people. The hope is that improve¬ 
ment in scientific understanding will obviate the need for arbitrary 
assumptions. Initial data on pharmacokinetics and DNA adducts are 
beginning to clarify critical issues (19). To date regulatory agencies 
seem reluctant to use these data when the} 7 imply lower estimated 
risks. But regulators must remember that current practice is based 
on assumptions rather than data; insisting that the current, some¬ 
what arbitrary, assumptions cannot be changed until there is 
.scientific consensus on a new approach - is to choose assumptions 
based on little or no data over models validated by data. 

In estimating probabilities from cither human or rodent data, the 
standard assumption is that incidence is proportional to dose 
measured in milligrams per kilogram of body weight or body surface 
area (a linear, no threshold dose-response relation), a conservative 
assumption but still one that is plausible in some cases. Data from 
both epidemiology and rodent studies show that linearity is the best 
assumption over a wide range for carcinogens such as ionizing 
radiation (20). For some carcinogens, halving the dose reduces the 
number of tumors by less than hal£ whereas for most chemicals 
tested, halving a large dose more than halves the number of tumors. 
The extreme case occurs for carcinogens that arc essential nutrients. 
Levels of chromium and nickel essential for nutrition are estimated 
to cause a small number of cancers (21). 

Finally, current practice for EPA in carcinogen assessment is not 
to use the best (maximum likelihood or central tendency) estimate 
of the linear term coefficient in a multistage model. Rather, they 
construct a 95% confidence interval about that estimated coefficient 
and use the upper bound (22). 

Although conservative assumptions are the rule, there are several 
places where the risk estimates might understate the true risk. First, 
people are not exposed to a single chemical, but rather to a number 
of chemicals. Even if they act independently, the risk will be the sum 
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of individual, chemical risks. Second, the chemicals may interact and 

potentiate or dampen the effects of other chemicals. Third, some 

individuals may be particularly sensitive to some chemicals, more so 

than the rodents used in testing. 

Nonetheless, agency risk assessors believe that, in general, their 
risk estimates overstate the true risks. In many cases there may be no 
risk to huimins associated with current exposure levels. While ther 
is still some chance that the risk estimates may understate true risks, 
agencies find that there is little threat associated with many environ¬ 
mental situations that cause popular concern, such as asbestos in 
good repair in buildings (12, 14, 23, 24). In contrast, the estimated 
risk associated with some hazards, such as radon in buildings, is 
extremely high for some homes (as high as 10,000 per million 
lifetimes), arsenic emissions from smelters (as high as 360,000 pei 
million lifetimes), and some food contaminants (the tolerance levei 
for afiatoxin in com implies 700 cancers per million lifetimes) (14). 
Current levels of public concern are not closely aligned to the 
estimated risk level (25). 

The value and even the interpretation of risk estimates are 
compromised by arbitrary assumptions, some conservative and some 
that would understate the true risk. Arbitrary assumptions inject 
scientists’ personal goals or interpretations of public desires into the 
risk analysis. Rather, the risk analysis should reflect the best science, 
the range of plausible models, and judgments, based on the best 
science, of the appropriate confidence intervals about these esti¬ 
mates. The risk managers need unbiased information with the 
uncertainties displayed explicitly to help them arrive at good 
decisions. Regulatory agencies should arrive at similar risk estimates 
for a substance. The risk management decisions may differ across 
agencies, depending on the goals embodied in the statutes and the 
individual costs and benefits of control. 


Food Additives 

Food addi tives can introduce hazards and tend to elicit a great 
deal of emotional response (26). “Risk-risk” situations occur, as 
when sodium nitrite increases the chance of cancer but reduces the 
chance of botulism. More frequent are “how safe” situations, where 
food additive improve the flavor, appearance, or shelf life of food 
but also increase the chance of cancer. Is having brightly colored 
maraschino cherries worth even a minuscule threat (the risk of red 
food color is estimated to be 0.02 cancer per million lifetimes) 

m 

Consumers do not “need” nonnutritive sweeteners, color addi¬ 
tives, or antioxidizers; food can be less sweet, can be sweetened with 
sugar, need not have vibrant colors, and can be susceptible to 
spoiling mors quickly. To some people, these properties are of little 
value; when foods are properly labeled, they select food without 
additives. To others, these properties are important and worth a tiny 
increase in the chance of cancer. As long as people understand the 
hazards, they can make their own choices. For saccharin-sweetened 
foods, Congr ess has required that the label must indicate ingredients 
and that warning signs be posted informing people of the carcino¬ 
genic potential. 

The mandate of the Food and Drug Administration (FDA) is to 
prevent food from becoming contaminated or adulterated; the FDA 
is to ensure that the. food supply is healthy (and varied and not 
needlessly expensive): (26). That mandate requires that the FDA 
define standards for what is aesthetically acceptable and what is safe 
enough. The FDA has evolved a policy that if a food additive (or its 
metabolites or breakdown products) increases the chance by less 
than one cancers per million lifetimes, the threat is considered to be 
too small to be of concern (27). This policy is highly controversial 
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and the subject of litigation. However, given the natural toxic 
substances in food, it is unclear what a sensible alternative would be 
( 28 ). The FDA finds the upper bound cancer probabilities for some 
food constituents and contaminants to be much larger than the 
comparable figure for food additives (one cancer per million 
lifetimes or less). For example, the tolerance level of aflatoxin in cor 
is estimated to increase the incidence of cancer by as much as 70 v 
per million lifetimes (14). 

What is the meaning of an estimated probability such as one 
cancer per million lifetimes (29)) The actual chance might well be 
zero, since a rodent carcinogen might not be a human carcinogen, or 
it might be larger, because humans are more sensitive to this 
chemical than rodents. Applied to the United States, this estimate 
literally means 230 cancers over 70 years or 3 to 4 additional cancers 
each year, added to the I million “background” cancers. In particu¬ 
lar, food colors, such as those used in coloring fruit cocktail, increase 
the risk about 0.4 cancer per million lifetimes, or about one cancer 
each year for the U.S. population. 

As long as people are presumed to be reasonably well informed 
and to be capable of making their own judgments, those who like 
vibrant colored fruit cocktail can consume it while others can avoid 
it. However, if this food is consumed by someone ignorant of the 
risks, such as a child, society must decide whether the food colors 
should be banned. Apparently, the FDA considers a risk estimate of 
one cancer per million lifetimes to be small enough to let individuals 
make their own decisions, even if there are some people who take 
the risk without realizing it. 


Traumatic Injuries and Death 

Risk assessment has had a long history in analysis of “accidents.” 
In 1985, 92,500 Americans were killed (about 5% of all deaths) and 
9 million persons sustained disabling injuries from accidents (30 
Almost half the deaths (45,600) were highway-related, 11,600 wen. 
work-related, 20,500 occurred at home, and 19,000 were other 
public accidents. Almost 60 million people were injured, resulting in 
543 million restricted activity days. Safety analysts dislike the term 
“accident” since it has a connotation of being beyond human 
control. Instead, each trauma injury has a cause, and steps could 
have been taken to avoid it or at least mitigate the injury. 

“Risk-risk” situations occur in designing safety equipment. If an 
energy-absorbing steering column in an automobile is designed to 
protect the driver during a low-speed crash, it offers less protection 
in a high-speed crash, and vice versa. One “how safe” situation is the 
controversy over whether air bags should be mandated in cars. 
There is no doubt that air bags would save lives, but the cost per life 
saved would be about SI million (31). 

A variety of approaches have been used to assess the frequencies 
and mitigation possibilities (32). The most important is statistical 
analysis to identify the frequency of events and conditions leading to 
injury or death. Others include crash investigation, injury epidemi¬ 
ology, behavioral feedback, economic approaches, human factors, 
and more recently, the use of fault and event trees (32). The last 
approach is embodied in probabilistic risk analysis, developed for 
nuclear reactors and now used in other areas (33). 

Aside from an occasional enthusiastic speech, no one talks about 
eliminating trauma—that would require banning activity. Activities 
such as mountain climbing are chosen by adults who can be 
presumed to be reasonably informed of the risks. For all activities, 
society tries to decrease risk by encouraging safe behavior and safer 
products; enhancing safety stops when the cost and inconvenien 
of increased safety exceeds the benefit of the safety gains (a “ho\. 
safe” decision). The social decision is complicated by human 
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reactions to the safer product that could increase risk (34); when 
people do not use safety features, their use can be mandated (55). 

Injury rates have declined markedly over many decades, whether 
measured by the fatalities per passenger mile for automobiles and 
commercial aircraft or occupational injury rates (30). Most of this 
decline is not related to governmental standards and inspection, but 
rather seems to come from company and consumer decisions as 
influenced by legal liability (36). 


Risk Management 

Bisk analysis is done to enlighten decisions about "how safe” and 
“risk-risk” situations* (37). Since the risk estimates have major 
uncertainties, they may be useless to the risk manager. If a toxic 
chemical is inexpensive to control or replace, even a hint of toxicity 
might lead to control (55), such as occurred in the banning of 
cyclamate. If a chemical is difficult to replace, such as vinyl chloride 
monomer or saccharin in 1978, it is unlikely to be banned even if the 
number of deaths associated with its use is nontrivial (59). 

Although the dose-response relation has received the most atten¬ 
tion, for health risks, exposure assessment adds greater uncertainty. 
This is anomalous since improving exposure assessment is not 
difficult. 

Providing warning labels and signs does not guarantee that 
people will read them or understand them (40). However, there is a 
basic social choice about the extent to which individuals should be 
allowed to make their own decisions and to be able to understand 
the information provided and the consequences of their choices. 
None of this means that the victim and others will not be terribly 
sorry when a (fiance is taken and it turns out badly. What range of 
hazardous choices will society allow' to individuals (41)} What 
information should be available to inform these decisions? Society is 
not and cannot be expected to maintain consistency, since these are 
hard decisions. For example, society allows individuals to smoke 
cigarettes while forbidding them to eat swordfish containing levels of 
mercury that pose a far lower risk. In some states a person traveling by 
car to spend a daviiang gliding must buckle his scat belt. 

Some haziirds, such as those associated with a nuclear reactor or a 
plant making pesticides, endanger people in the vicinity; the deci¬ 
sion concerning where to locate them is inherently social in nature 
since the individuals living nearby will have to accept this risk. Some 
of these people will see the plant as offering a trivial increase in risk, 
but others w’ill see it as life threatening. Because individ uals can do 
little to adjure their risk level, these situations exasperate those who 
disagree with the social decision (42). 

"Bisk-risk” situations require a balancing. This structure pre¬ 
cludes rhetoric about being willing to spend anything to prevent a 
premature death. The "how' safe” situation invites fuzzy thinking 
and rhetoric. The issue, is not how many pieces of green paper are 
worth preventing a premature death, but rather how much inconve¬ 
nience and discomfort to bear and how much consumption of other 
goods and services to give up to low'er the probability of disease or 
death a bit more (43). 

A person may appear to engage in inconsistent behavior in 
smoking cigarettes while worrying about food additives or not 
testing for radon while worrying about asbestos that is in good 
repair. The apparent contradictions may result from a complicated 
cognitive structure for perceiving hazardous situations (25). People 
are concerned with aspects different from those that experts focus 
on. Since they are the consumers and the voters in our democracy, 
people are the final arbiters of how r safe is safe enough. 

For guidance on what risk levels to set, a variety' of approaches has 
been used. One attempts to find what is a trivial or de minimis risk, 
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so that the limited resources for improvement are not wasted to 
reduce risks beyond this level (14, 44). A second approach is to 
examine hazards that are readily accepted in everyday life and in 
regulations (29). A third is to seek public guidance through 
referendums or through the actions of elected representatives. 
Several state referendums on nuclear power have done little to clarify 
public preferences; each was voted dowm but each was phrased in 
such an extreme form that a moderate critic of nuclear power might 
have voted against the measure. Congress has not been much more 
informative, since legislation generally contains contradictory' lan¬ 
guage. For example, the Occupational Safety and Health Act sets a 
goal” “... that no employee will suffer material impairment of 
health or functional capacity..however, the act also requires 
that the regulations "... assure insofar as practicable ...” which is 
interpreted to mean both technical and economic feasibility. In one 
of the few' cases where Congress was unequivocal about setting a 
stringent risk standard, the Delaney amendment to prohibit carcino¬ 
genic food additives, the FDA has permitted them, as long as they 
pose a tiny risk (17, 27). Congress, the agencies, and the courts are 
concerned that safety' regulations not be so stringent as to halt the 
economy or even shut an industry'. The result is that Occupational 
Safety' and Health Act and EPA sometimes tolerate extremely large 
hazards because it is not technically or economically feasible to deal 
with them. 

Just as a great advantage of risk assessment is bringing the 
calculations out into the open, uncertainties and all, so one of the 
great advantages of risk management has been bringing the decision 
process out into the open. Since the probabilities cannot be lowered 
to zero, there is good reason to inform the affected parties and the 
public of the basis for a decision. While it is time consuming and 
apparently wasteful to reach these decisions in a fishbowl, there is no 
other process likely to secure public confidence and consent. 


Conclusion 

Bisk analysts should not attempt to overstate or understate 
threats, but rather to give a best estimate and the range of 
uncertainty. Decision-makers can choose the proper amount of 
conservatism in setting the standard. The various federal agencies 
ought to coordinate their risk assessment processes so that they will 
arrive at similar' estimates for a particular hazard. 

Current risk estimates are fraught with uncertainty.- The process 
of conducting and defending risk analyses highlights these uncer¬ 
tainties and suggests a research agenda to resolve them. Rather than 
reify existing arbitrary assumptions, the process must be opened to 
new data and models, particularly since current assumptions often 
are based on little or no data. 

It is inherently easier to manage "risk-risk” situations than "how 
safe” situations. The former are self-limiting and require an explicit 
balancing of the risks. The latter are subject to rhetoric about zero 
risk because there is no necessity to consider what is being sacrificed 
to lower the probability further. Risk management is inherently 
difficult not only because it requires setting specific goals, but 
because the situations involved often affect many people simulta¬ 
neously, requiring a collective decision. Since people have different 
safely' goals and arc uncomfortable thinking about hazardous situa¬ 
tions, collective decisions are difficult. 

Progress in the field of risk analysis has been enormous—it hardlv 
existed a decade ago. The intellectual ferment comes from the focus 
on helping to enlighten decisions, rather than on intellectual 
elegance. The constant interaction of those involved in risk analysis 
and in risk management is needed to stimulate analysts to make their 
greatest contribution. 
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